CVEvulnerability
CVE-2014-4149
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-11-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 does not properly perform TypeFilterLevel checks, which allows remote attackers to execute arbitrary code via crafted data to a .NET Remoting endpoint, aka "TypeFilterLevel Vulnerability."
Affected configurations
• microsoft .net framework 1.1
• microsoft .net framework 2.0
• microsoft .net framework 3.5
• microsoft .net framework 3.5.1
• microsoft .net framework 4.0
• microsoft .net framework 4.5
• microsoft .net framework 4.5.1
• microsoft .net framework 4.5.2
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx Vendor Advisory
- http://www.securitytracker.com/id/1031188 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072 docs.microsoft.com
- http://blogs.technet.com/b/srd/archive/2014/11/11/ms14-072-net-remoting-elevation-of-privilege-vulnerability.aspx Vendor Advisory
- http://www.securitytracker.com/id/1031188 www.securitytracker.com
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-072 docs.microsoft.com